<html>
<head><meta charset="utf-8"><title>New pile of unsafe code · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html">New pile of unsafe code</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="203219389"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203219389" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203219389">(Jul 08 2020 at 00:26)</a>:</h4>
<p>Hi folks. I wrote Abomonation, and am the sort of person who you may have a photo of on your dart board. I had some free time last week, and put together a different framework with less obvious unsafety, <a href="https://github.com/frankmcsherry/columnation">https://github.com/frankmcsherry/columnation</a>, but I thought it might be reasonable to exercise any unsafe code guidelines you might have. In particular, it does some things that are <code>unsafe</code>, but may or may not be UB depending on .. I don't know aliasing rules ... something. The intent, as always, is that it is not unsafe, but if you'd like someone to read through what you have and attempt to make something safe as a result I'm available to try that out.</p>



<a name="203627287"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203627287" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203627287">(Jul 12 2020 at 04:28)</a>:</h4>
<p>I was confused by the fact that the regions still had nested Vecs (local: Vec&lt;Vec&lt;T&gt;&gt;) since it seemed like the same thing as the naive alternative until I realized it never reallocates them and uses a growth pattern and reuses storage within them when available</p>



<a name="203627360"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203627360" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203627360">(Jul 12 2020 at 04:30)</a>:</h4>
<p>(deleted)</p>



<a name="203627422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203627422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203627422">(Jul 12 2020 at 04:33)</a>:</h4>
<p>(deleted)</p>



<a name="203630386"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203630386" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203630386">(Jul 12 2020 at 06:21)</a>:</h4>
<p>So, if I understood correctly, the point of this crate is ColumnStack&lt;T&gt;, which is an alternative to a grow-only no-mutable-refs-into-contents Vec&lt;T&gt; but requires T:Columnation<br>
Columnation just defines an associated type that impls ColumnarRegion</p>
<p>The interesting part of ColumnarRegion is copy(&amp;mut self, item: *mut T). ColumnStack just holds a Vec of Ts and a Region, and when someone tries to push something onto the stack, it just makes a bitwise copy of it, and calls the Region's Copy with a mutable reference to that copy. The Region takes care of doing a "deep copy" of the pointers that the input holds, and then overwrites the input with pointers into that storage. Then the Stack's copy() appends it to it's Vec (And it takes care to never Drop the elements in it)<br>
For Copy types copy() is implemented empty. And Vec/String keep a Vec&lt;Vec&lt;_&gt;&gt; where they actually store things. The inner Vecs never realloc such that the pointers in T's in the Stack don't get invalidated. It attempts to reuse storage in existing Vecs, and when they run out just makes a new one (with powers-of-two growth at the moment)</p>
<p>The point of this is that if you have a nested type such as Vec&lt;Vec&lt;String&gt;&gt; and you replace it with  ColumnStack&lt;Vec&lt;String&gt;&gt; you can store all the inner String structs contiguously (Kind of contigously because of the Vec&lt;Vec&lt;_&gt;&gt; thing mentioned above) and all the data for String's (Stored as u8's) contigously</p>
<p>Sent a pull request with a bug fix (If I understand it correctly, apologies if I misunderstood something)</p>



<a name="203631550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203631550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203631550">(Jul 12 2020 at 07:05)</a>:</h4>
<p>Would it be any better to use ManuallyDrop in the Vec in ColumnStack?</p>



<a name="203631590"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203631590" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203631590">(Jul 12 2020 at 07:06)</a>:</h4>
<p>It would save you from one unsafe in clear() and the need for a custom Drop impl I think</p>



<a name="203631595"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203631595" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203631595">(Jul 12 2020 at 07:06)</a>:</h4>
<p>Idem for the Vec and String Regions right?</p>



<a name="203631854"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203631854" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203631854">(Jul 12 2020 at 07:17)</a>:</h4>
<p>Should Columnation not be an unsafe trait?</p>



<a name="203684448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203684448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203684448">(Jul 13 2020 at 07:21)</a>:</h4>
<p><span class="user-mention" data-user-id="116609">@Frank McSherry</span> without having time to dig deep into your code right now (also also github just shows server errors), did you try running your test suite (you do have a test suite right) in Miri? your test suite may not explore the "interesting" paths in terms of aliasing rules but getting a green pass from miri is still always a good start.</p>



<a name="203705353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203705353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203705353">(Jul 13 2020 at 11:54)</a>:</h4>
<p>Can do. I def wasn't looking for a code review so much as being willing to read any guidance you all  may have produced, and come back with the results for assessment (of the guidance, more than the code). Will  try out miri, as one form of guidance, and will report back.u</p>



<a name="203705416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203705416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203705416">(Jul 13 2020 at 11:55)</a>:</h4>
<p><span class="user-mention" data-user-id="219940">@Nick12</span> just getting to your PRs this morning; sorry for the delay (<span class="user-mention" data-user-id="120791">@RalfJ</span>'s ping got me here)</p>



<a name="203705602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203705602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203705602">(Jul 13 2020 at 11:58)</a>:</h4>
<p><span class="user-mention" data-user-id="219940">@Nick12</span> I think probably the main design ? I have is whether it is appropriate to memcopy the vector spine first, and then correct the pointers (it that transient moment, it is a mutable pointer that can transiently reference stuff that came in as immutable) or whether I need to be more conservative and first create the targets and then construct the whole vec/string/etc from that.</p>



<a name="203717416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203717416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203717416">(Jul 13 2020 at 13:56)</a>:</h4>
<p>I find it hard to answer such questions in the abstract; a concrete piece of code would help.</p>



<a name="203717488"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203717488" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203717488">(Jul 13 2020 at 13:56)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116609">Frank McSherry</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code/near/203705353">said</a>:</p>
<blockquote>
<p>Can do. I def wasn't looking for a code review so much as being willing to read any guidance you all  may have produced, and come back with the results for assessment (of the guidance, more than the code). Will  try out miri, as one form of guidance, and will report back.u</p>
</blockquote>
<p>in terms of aliasing, I think all we got is <a href="https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md">https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md</a></p>



<a name="203744900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203744900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203744900">(Jul 13 2020 at 17:34)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I think my anxiety is tied up in the following bit of code</p>
<div class="codehilite"><pre><span></span><code><span class="w">    </span><span class="sd">/// The element can be read by indexing</span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">copy</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">,</span><span class="w"> </span><span class="n">item</span>: <span class="kp">&amp;</span><span class="nc">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">read</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">std</span>::<span class="n">ptr</span>::<span class="n">read</span><span class="p">(</span><span class="n">item</span><span class="p">);</span><span class="w"></span>
<span class="w">            </span><span class="bp">self</span><span class="p">.</span><span class="n">inner</span><span class="p">.</span><span class="n">copy</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">read</span><span class="p">);</span><span class="w"></span>
<span class="w">            </span><span class="bp">self</span><span class="p">.</span><span class="n">local</span><span class="p">.</span><span class="n">push</span><span class="p">(</span><span class="n">read</span><span class="p">);</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
</code></pre></div>


<p>whose intent is that it reads out a copy of the thing <code>item</code> references, and then uses that copy to populate some internal data structures, while also changing the copy (though, not changing any data that can be reached from <code>item</code>). The line</p>
<div class="codehilite"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">read</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">std</span>::<span class="n">ptr</span>::<span class="n">read</span><span class="p">(</span><span class="n">item</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>already seems to potentially create a mutable reference to a thing also referenced by <code>item</code> (e.g. if <code>T</code> is <code>String</code>). Because I am a 'fraidy cat, I worry that this might already violate some aliasing rules. The code continues to capture a <code>&amp;mut</code> ref to that copy, almost certainly not correct about uniqueness of reference, but only to extract a <code>*mut</code> (no intent to use the uniqueness property, but not otherwise clear to me how to get a <code>*mut T</code> from a <code>mut T</code>).</p>
<p>The rest of the code uses <code>*mut T</code> generally, and may be less likely to be UB because of aliasing (and doesn't do any naughty business with <code>transmute</code>).</p>
<p>I'll take a read through the stacked borrows and try to get myself up to speed rather than have you provide manual education. Also, just to re-iterate, this is a non-urgent issue and I mostly thought it would be a good exercise to see if normal people can grok any rules, rather than "let's get top minds to diagnose an important library", which this is not (yet).</p>
<p>Thanks!</p>



<a name="203745585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203745585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203745585">(Jul 13 2020 at 17:40)</a>:</h4>
<p>Anything prevent <code>T</code> from being <code>&amp;mut u8</code> or similar?</p>



<a name="203805146"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203805146" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203805146">(Jul 14 2020 at 07:19)</a>:</h4>
<blockquote>
<p>already seems to potentially create a mutable reference to a thing also referenced by item (e.g. if T is String). </p>
</blockquote>
<p>hm, there's no mutable reference in <code>String</code>. The more interesting cases are <code>T = &amp;mut _</code> or <code>T = Box&lt;_&gt;</code>.</p>



<a name="203805173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203805173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203805173">(Jul 14 2020 at 07:19)</a>:</h4>
<p>but it seems like <code>item</code> itself is not used any more later?</p>



<a name="203805229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203805229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203805229">(Jul 14 2020 at 07:20)</a>:</h4>
<p>it's a bit hard to say what happens without knowing what <code>copy</code> and <code>push</code> do.</p>



<a name="203805241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203805241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203805241">(Jul 14 2020 at 07:20)</a>:</h4>
<blockquote>
<p>Also, just to re-iterate, this is a non-urgent issue and I mostly thought it would be a good exercise to see if normal people can grok any rules, rather than "let's get top minds to diagnose an important library", which this is not (yet).</p>
</blockquote>
<p>Those are great exercises :)</p>



<a name="203805259"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203805259" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203805259">(Jul 14 2020 at 07:20)</a>:</h4>
<p>If <code>T</code> can be <code>String</code> then aliasing isn't really the thing I'd worry about, rather double drops from <code>read</code> being dropped at any point. If anything ever panics then also the <code>self.local: Vec&lt;T&gt;</code> is dropped, which drops the strings, which then double drops when the outer <code>item</code> is dropped.</p>



<a name="203880928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203880928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203880928">(Jul 14 2020 at 20:07)</a>:</h4>
<blockquote>
<p>hm, there's no mutable reference in String. The more interesting cases are T = &amp;mut _ or T = Box&lt;_&gt;.</p>
</blockquote>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span>  Well, I def don't understand the rules then. :D  It seems that from a <code>mut String</code> I have access to a <code>&amp;mut str</code> that I could muck around with, which could stress out some part of reasoning about a <code>&amp;String</code> backed by the same data elsewhere. I'm sure I don't have the right mental model for "that is only a problem when..." and just imagine that it encroaches on UB as soon as there is some bad aliasing.</p>
<p>I got a bit busy this week and haven't had the chance to do my part of the work yet; sorry!</p>



<a name="203881196"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203881196" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Frank McSherry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203881196">(Jul 14 2020 at 20:09)</a>:</h4>
<blockquote>
<p>If anything ever panics then also the self.local: Vec&lt;T&gt; is dropped, which drops the strings, which then double drops when the outer item is dropped.</p>
</blockquote>
<p><span class="user-mention" data-user-id="229913">@HeroicKatora</span> The code <em>intends</em> to deal with this, though it's possibly wrong (the <code>Drop</code> impl zeros out the length, which I imagined suppressed recursive drops). <span class="user-mention" data-user-id="219940">@Nick12</span> had what I bet is a more idiomatic version using <code>ManuallyDrop&lt;T&gt;</code> though I'm still trying to get my head around it.</p>



<a name="203923501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20pile%20of%20unsafe%20code/near/203923501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20pile.20of.20unsafe.20code.html#203923501">(Jul 15 2020 at 07:26)</a>:</h4>
<blockquote>
<p>Well, I def don't understand the rules then. :D It seems that from a mut String I have access to a &amp;mut str that I could muck around with, which could stress out some part of reasoning about a &amp;String backed by the same data elsewhere. I'm sure I don't have the right mental model for "that is only a problem when..." and just imagine that it encroaches on UB as soon as there is some bad aliasing.</p>
</blockquote>
<p>you could do many things, but do you do them?<br>
I guess I'll wait for some more concrete code examples, as I still don't get the interaction here that you think is UB.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>